Bug 2466997 (CVE-2026-43099)

Summary: CVE-2026-43099 kernel: ipv4: icmp: fix null-ptr-deref in icmp_build_probe()
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel, specifically within the IPv4 (Internet Protocol version 4) and ICMP (Internet Control Message Protocol) components. When the IPv6 (Internet Protocol version 6) stack is not active, a specific function (`ipv6_dev_find`) can return an error. If this error is then passed to another function (`dev_hold`), it leads to a null pointer dereference, causing the kernel to crash. This vulnerability could result in a Denial of Service (DoS) for the affected system.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-05-06 10:02:26 UTC 
In the Linux kernel, the following vulnerability has been resolved:

ipv4: icmp: fix null-ptr-deref in icmp_build_probe()

ipv6_stub->ipv6_dev_find() may return ERR_PTR(-EAFNOSUPPORT) when the
IPv6 stack is not active (CONFIG_IPV6=m and not loaded), and passing
this error pointer to dev_hold() will cause a kernel crash with
null-ptr-deref.

Instead, silently discard the request. RFC 8335 does not appear to
define a specific response for the case where an IPv6 interface
identifier is syntactically valid but the implementation cannot perform
the lookup at runtime, and silently dropping the request may safer than
misreporting "No Such Interface".
Comment 1 Alexander B 2026-05-06 14:39:13 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026050620-CVE-2026-43099-96e4@gregkh/T